Citrus ransomware: inside the VLESS and Sn00py attack chain

Citrus ransomware stands out less because it relies on novel intrusion tools than because it combines familiar Windows administration techniques with concealed command-and-control traffic and a ransomware payload from the Sn00py family. In a report published by Securelist, Kaspersky researchers describe a previously undocumented group that compromises contractor access, moves through enterprise environments, collects credentials and messaging data, and uses malicious Group Policy Objects to distribute encryption at scale.

The report also documents the group’s use of Xray to establish reverse VLESS tunnels, its deployment of AnyDesk for remote control, and apparent use of large language models (LLMs) to generate commands and scripts. Kaspersky assesses that Citrus shares tooling, procedures, and victimology with Toy Ghouls, although the researchers say the two groups’ infrastructure did not directly overlap.

This combination creates a familiar defensive challenge: the most important warning signs may be the sequence and context of ordinary administrative activity rather than a single unusual binary.

Access begins with contractor accounts

According to Kaspersky, Citrus gains initial access through compromised contractors. The attackers use credentials stolen from contractor employees to connect to corporate VPN services or directly to internet-facing terminal servers over Remote Desktop Protocol (RDP). The report does not identify specific victims by name, and its account of the campaign should not be read as evidence that every contractor-connected organization is affected.

Once inside, the operators use standard Windows command execution through Command Prompt and PowerShell. They create scripts, batch files, and one-off commands as the intrusion develops. Kaspersky found examples of commands with explanatory comments and scripts whose structure and comments were consistent with LLM-generated output. The researchers therefore assess that LLMs supported parts of the operational workflow, but the report does not establish that an autonomous system conducted the attacks.

The group also uses atexec from the Impacket collection to create scheduled tasks on remote systems. Kaspersky observed randomly styled task names and did not recover the precise commands associated with every task. The researchers say a subsequent Group Policy refresh suggests that some of those tasks may have executed gpupdate /force. On 1C:Enterprise servers, the operators use 1C-Shell, an external data processor, to execute commands.

Persistence, privilege escalation, and concealment

Scheduled tasks are the main persistence mechanism described in the report. Attackers create them manually through PowerShell to launch tools automatically. On systems that are rarely rebooted, including some terminal servers, they sometimes operate without adding persistence.

Kaspersky says the contractor domain accounts used for entry had limited privileges. The operators consequently attempted to escalate access through vulnerabilities and configuration weaknesses. One reported route involved CVE-2026-54121, identified in the report as the Certighost authentication-bypass vulnerability. Exploitation attempts created Active Directory machine accounts with names beginning with GHOST, followed by varying characters. These account names are a potentially useful investigative clue where the vulnerability is relevant, but the supplied research does not provide a remediation status or a complete assessment of affected product versions.

The report also links attempted privilege escalation to CVE-2020-1337. Kaspersky found PowerShell scripts containing an exploit associated with that vulnerability, and noted that the same exploit was available in the Metasploit GitHub repository. The report does not claim that this was the initial access method.

Insecure 1C:Enterprise configurations are another concern. Kaspersky highlights that these systems are often administered by support personnel with elevated Active Directory privileges, making them valuable stepping stones for lateral movement.

The operators attempt to frustrate investigation by deleting tools and output files and clearing command history. They also use legitimate-looking names associated with security software, including files and scheduled tasks containing “Kaspersky” or “KasperskyAgent.” Kaspersky explicitly reports that its own products detected and blocked the malicious files despite that masquerading.

Disabling security controls

After obtaining sufficient privileges, Citrus attempts to weaken endpoint and centralized security controls. The observed actions include clearing selected Windows event logs with wevtutil, disabling antivirus protection on individual hosts, and targeting centralized security-management consoles to turn protection off more broadly.

The ransomware’s deployment policy modifies Windows Defender settings through the registry and adds malicious tools to antivirus exclusion lists. Kaspersky also observed a malicious Group Policy Object that disables Windows Defender, enables WinRM, disables the Volume Shadow Copy service, and creates a scheduled task to run the ransomware. These changes are important because they can provide earlier detection opportunities than the final encryption event.

Credential theft and internal reconnaissance

Citrus uses a modified version of the publicly available peeping-tom keylogger. In the sample described by Kaspersky, the executable was placed at C:\ProgramData\Oracle\Java\jhost.exe, with captured keystrokes written to C:\Users\<username>\AppData\Roaming\Microsoft\CLR\ErrorLog.txt. The researchers observed stolen data being sent to 91.210.109[.]118.

The group also uses Mimikatz to dump credentials from memory and Snaffler to search accessible network shares for secrets such as SSH keys and access tokens. Administrator workstations and password-manager data, including KeePass-related information, were also of interest.

Discovery begins with routine commands such as whoami, tasklist, quser, and ipconfig. The operators used curl to query 2ip[.]io for the system’s external address. For network discovery, Kaspersky observed fscan scans focused on ports 135, 139, 1433, and 8006. The group subsequently used ADRecon, SharpHound, LDAP queries, and net.exe to enumerate systems, users, and privileged groups.

Lateral movement relies on SSH, RDP, and WinRM. Connections may be made directly from compromised hosts or through tunnels established earlier in the intrusion.

VLESS tunnels conceal command and control

For tool delivery, the operators use built-in utilities and services, including certutil, BITS, cURL, and PowerShell. Kaspersky reports that these methods deliver Xray, which is then configured to create a reverse VLESS tunnel to an operator-controlled server.

The recovered Xray configuration was commonly stored in config.json, although the attackers sometimes deleted the file immediately after starting the tunnel. The VLESS service used port 443, helping its traffic resemble ordinary HTTPS. Configurations also included REALITY settings intended to disguise traffic as requests to legitimate sites such as mirror[.]yandex[.]ru and yastatic[.]net. The use of a familiar port or a legitimate-looking destination does not make the traffic benign; defenders should examine the process that creates the connection and the endpoint’s broader behavior.

Citrus also installs AnyDesk for remote control. The software is installed silently, configured with a connection password, and queried through PowerShell to retrieve the affected system’s client identifier. AnyDesk itself is legitimate, so the key detection question is whether its installation and configuration are authorized and consistent with the organization’s support practices.

Collection precedes encryption

Shortly before encryption, the operators ran steal_tgs.ps1 on a domain controller. The script created a tdatas directory, and 7-Zip produced archives with names resembling <system_name>_<date>_<username>_tdata.zip. Kaspersky assesses that this activity likely targeted Telegram Desktop’s tdata directory, which can contain authorization keys, session information, and application settings.

The archives were uploaded through Google Chrome to an external web service. The report therefore describes a sequence in which Citrus seeks both technical control of the network and access to potentially sensitive messaging-session data before deploying ransomware.

Sn00py ransomware and domain-wide deployment

The encryption payload is written in Go and uses RSA-2048 and ChaCha20 to encrypt user files on Windows systems. System files are excluded, and encrypted files receive the .citrus extension. Kaspersky states that decryption was not possible without the attackers’ private key in the cases analyzed.

The malware displays its activity in a console and attempts to modify boot configuration data by invoking bcedit, which the researchers identify as likely a typographical error for bcdedit. Its configuration includes a Citrus public key and a host blacklist containing domain controller names such as DC01 through DC04. Kaspersky assesses that excluding these systems helps preserve the Group Policy infrastructure used to distribute the ransomware.

The group’s malicious GPO is packaged in self-extracting archives. A PowerShell script copies the ransomware archive into the domain’s SYSVOL directory, links the policy to the domain, and distributes the payload. The policy creates a scheduled task, enables WinRM, disables Volume Shadow Copy and Windows Defender, and changes the desktop wallpaper to display the ransom note. The malware drops CITRUS_README.txt files and appends the .citrus extension to encrypted data.

The ransom note references a 72-hour contact window and threatens disclosure of organizational and employee information. The report does not confirm whether the group carried out every threatened disclosure.

Assessment of links to Toy Ghouls

Kaspersky does not present the Toy Ghouls connection as a confirmed identity finding. Instead, the researchers point to shared tactics, tools, storage locations, Russian-language characteristics, and attacks against Russian companies. The report says that in several incidents, the same infrastructure was compromised simultaneously by Toy Ghouls and Citrus. However, the groups’ infrastructures did not directly overlap in the analysis.

These observations support a relationship or operational similarity assessment, not definitive proof that the groups are the same organization.

What organizations should do now

• Control contractor access. Require strong authentication, restrict VPN and RDP exposure, limit contractor accounts to necessary resources, and review dormant or excessive privileges.
• Monitor identity and policy changes. Alert on unexpected machine-account creation, especially names beginning with GHOST, new domain-linked GPOs, changes to SYSVOL, and modifications affecting Defender, WinRM, Shadow Copy, or antivirus exclusions.
• Investigate scheduled tasks. Review newly created tasks, unusual executables, randomly generated names, and tasks launching from ProgramData, Windows\Temp, SYSVOL, or user profile directories.
• Hunt for suspicious remote-control and tunneling activity. Correlate Xray or AnyDesk execution with outbound connections on port 443, PowerShell, BITS, certutil, and deleted Xray configuration files.
• Protect credentials and sessions. Restrict credential-dumping opportunities, secure administrator workstations, review access to password-manager files and network shares, and investigate unexpected keylogger-like files or Telegram tdata archives.
• Preserve evidence. Centralize PowerShell, process, task, authentication, Group Policy, and network telemetry so that clearing local logs does not erase the investigation trail.
• Validate recovery. Maintain offline or otherwise isolated backups, test restoration, and ensure recovery procedures do not depend on the same domain infrastructure targeted by a malicious GPO.

Conclusion

Citrus demonstrates how ransomware operators can combine compromised third-party access, ordinary administration tools, concealed VLESS transport, credential theft, and domain-wide policy deployment. The reported use of LLM-generated commands appears to improve the speed and polish of auxiliary tooling, but the underlying activity remains observable through identity, endpoint, Group Policy, and network telemetry. Organizations that tightly govern contractor access and rapidly investigate unexpected administrative changes have the best chance of interrupting the chain before Sn00py encryption begins.

Sources

Securelist: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand